37 C.F.R. § 1 .607(a). In particular, the correspondence between the claims herein and those 
of the McCreery patent is provided herein below. The substantially copied claims may be 
specifically applied to Applicants' disclosures as follows: 



COPIED CLAIMS 



APPLICANT'S DISCLOSURE 



29. 



(New) An apparatus for analyzing 
network activity, the apparatus 
comprising: 



a packet capturing module, for accessing 
the packets traversing a network, the packets 
having source and destination addresses of 
network devices exclusive of the apparatus, and 
for filtering the packets to produce packet data, 
wherein the packet capturing module produces 
the packet data by retrieving a predetermined 
address, comparing the predetermined address to 
the source and destination addresses for a current 
packet and retaining the current packet when one 
of the source and destination addresses for the 
current packet matches the predetermined 
address; . 

a packet analyzing module, in 
communication witfilhe packet capturing module, 
for producing decoded packet data, wherein the 
decoded packet data includes a plurality of 
patterns of packets, and for producing transaction 
data from the decoded packet data, wherein the 
transaction data is derived from a time value for 
identifying a substantially optimal collection of 
patterns of packet s indicative of transaction 
instances; and 



a data management module, in 
communication with the packet capturing module 
and the packet analyzing module, for analyzing 
the packet data and the transaction data to 
provide an indication of network usage. 



page 1, lines 5-8; page 4, lines 22- 
25; page 10, lines 5-19; page 32, 
lines 4-17; Figure 12 

page 4, lines 9-12; page 5, lines 
10-18; page 10, line 21 to page 12, 
line 1 1; page 12, line 19- page 14, 
line 7; pg. 12, lines 5-8; page 15, 
line 15- page 16, line 4; Figures 1- 
6A; Abstract 



page 4, line 9- page 9, line 2; page 
10, line 5- page 1 1, line 16; page 
15, line 15- page 18, line 19; page 
18, line 21- page 32, line 3; 
Figures 1-2 and 6 A- 11 



page 4, lines 9-25; page 6, line 12- 
page 8, line 12; page 10, lines 5- 
19; page 18, line 21- page 32, line 
26; Figures 1-2 and 6A-12 
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30. (New) An apparatus for analyzing 
network activity, the apparatus comprising: 

a packet capturing module, for accessing 
the packets traversing a network, the packets 
having source and destination addresses of 
network devices exclusive of the apparatus, and 
for filtering the packets to produce packet data, 
wherein the packet capturing module produces 
the packet data by accessing a predetermined 
address, comparing the predetermined address to 
the source and destination addresses for a current 
packet, and retaining the current packet when one 
of the source and destination addresses for the 
current packet matches the predetermined 
address; 

a packet analyzing module, in 
communication with the packet capturing module, 
for producing decoded packet data and for 
producing transaction data from the decoded 
packet data; and 

a data management module, in 
communication with the packet capturing module 
and the packet analyzing module, for analyzing at 
least one of the packet data and the transaction 
data to provide an indication of network usage. 


page'l, lines 5-8; page 4, lines 22- 
25; page 10, lines 5-19; pag6 32, 
lines 4-17; Figure;! 2 

page 4, lines 9-12; page 5, lines 
10-18; page 10, line 21 to page 12, 
line 1 1; page 12, line 19- page 14, 
line 7; pg. 12, lines 5-8; page 15, 
Une 15- page 16, line 4; Figures h 
6A; Abstract 

page 4, line 9- page 9, line 2; page 
10, line 5- page 1 1, line 16; page 
15, line 15- page 18, line 19; page 
18, line 21- page 32, line 3; 
Figures 1-2 and 6A-1 1 

page 4, lines 9-25; page 6, line 12- 
page 8, line 12; page 10, lines 5- 
19; page 18, line 21- page 32, line 
26; Figures 1-2 and 6A-12; 
jUmmsri -2-and .4-8 


31. (New) An apparatus for analyzing 
network activity, the apparatus comprising: 

a packet capturing module, for accessing 
the packets traversing a network, the packets 
having source and destination addresses of 
network devices exclusive of the apparatus, and 
for filtering the packets to produce packet data, 
wherein the packet capturing module produces 


page 1, lines 5-8; page 4, lines 22- 
25; page 10, lines 5-19; page 32, 
lines 4-17; Figure 12 

page 4, lines 9-12; page 5, lines 
10-18; page 10, lme 21 to page 12, 
line 11; page 12, line 19- page 14, 
line 7; pg. 12, lines 5-8; page 15, 
line 15- page 16, line 4; Figures 1- 
6A; Abstract 



19 



the packet data by retrieving a predetermined port 
address, comparing the predetermined port 
address to a source port address for a current 
packet, comparing the predetermined port address 
to a destination port address for the current 
packet, and retaining the current packet when one 
of the source and destination port addresses for 
the current packet matches the predetermined 
port address; 

a packet analyzing module, in 
communication with the packet capturing module, 
for producing decoded packet data, wherein the 
decoded packet data includes a plurality of 
patterns of packets, and for producing transaction 
data from the decoded packet data, wherein the 
transaction data is derived from a time value for 
identifying a substantially optimal collection of 
patterns of packets indicative of transaction 
occurrences; and 

a data management module, in 
communication with the packet capturing module 
and the packet analyzing module, for analyzing 
the packet data and the transaction data to 
provide an indication of network usage. 


page 4, line 9- page 9, line 2; page 
10, line 5- page 1 1, line 16; page 
15, line 15- page 18, line 19; page 
18, line 21- page 32, line 3; 
Figures 1-2 and 6A-1 1 

page 4, lines 9-25; page 6, line 12- 
page 8, line 12; page 10, lines 5- 
19; page 18, line 21- page 32, line 
26; Figures 1-2 and 6A-12 


32. (New) An apparatus for analyzing 
network activity, the apparatus comprising: 

a packet capturing module, for accessing 
the packets traversing a network, the packets 
having source and destination addresses other 
than an address corresponding to the apparatus, 
and for filtering the packets to produce raw 
packet data, wherein the packet capturing module 
produces the raw packet data by accessing a 
predetermined port address, comparing the 


page 1, lines 5-8; page 4, lines 22- 
25; page 10, lines 5-19; page 32, 
lines 4-17; Figure 12 

page 4, lines 9-12; page 5, lines 
10-18; page 10, line 21 to page 12, 
line 11; page 12, line 19- page 14, 
line 7; pg. 12, lines 5-8; page 15, 
line 15- page 16, line 4; Figures 1- 
6A; Abstract 




predetermined port address to a source port 
address for a current packet, comparing the 
predetermined port address to a destination port 
address for the current packet, and retaining the 
current packet when one of the source and 
destination port addresses for the current packet 
matches the predetermined port address; 

a packet analyzing module, in 
communication with the packet capturing module, 
for producing decoded packet data and for 
producing transaction data from the decoded 
packet data; and 

a data management module, in 
communication with the packet capturing module 
and the packet analyzing module, for analyzing at 
least one of the raw packet data, the decoded 
packet data, and the transaction data to provide 
an indication of network usage. 


page 4, line 9- page 9, line 2; page 
10, line 5- page 11, line 16; page 
15, line 15- page 18, line 19; page 
18, line 21- page 32, line 3; 
Figures 1-2 and 6A-1 1 

page 4, lines 9-25; page 6, line 12- 
page 8, lme 12; page 10, lines 5- 
19; page 18, line 21- page 32, line 
26; Figures 1-2 and 6A-12; 
clahns4-2^andLiL8 


33. (New) An apparatus for analyzing 
network activity, the apparatus 
comprising: 

a packet capturing module, for accessing a 
plurality of packets traversing a network, the 
packets having source and destination addresses 
of network devices exclusive of the apparatus, 
and for filtering the packets to produce packet 
data; 

a packet analyzing module, in 
communication with the packet capturing module, 
for producing decoded packet data and for 
producing transaction data from the decoded 
packet data, the packet decoding module 
comprising (a) and (b) following: 

(a) a packet decoder, for accessing the 
packet data and producing the decoded packet 


page 1, lines 5-8; page 4, lines 22- 
25; page 10, lines 5-19; page 32, 
lines 4-17; Figure 12 

page 4, lines 9-12; page 5, lines 
10-18; page 10, line 21 to page 12, 
line 11; page 12, line 19- page 14, 
line 7; pg. 12, lines 5-8; page 15, 
line 15- page 16, line 4; Figures 1- 
6A; Abstract 

page 4, line 9- page 9, line 2; page 
10, line 5- page 1 1, line 16; page 
15, line 15- page 18, line 19; page 
18, line 21- page 32, line 3; 
Figures 1-2 and 6 A- 11 

page 16, line 13- page 18, line 19; 
Figures 1 and 2, 6A-6D, 7-9 A, and 



data by searching in text of the packet data for 
one or more key words; and 

(b) a decoded packet recompiler, in 
communication with the packet decoder, for 
accessing the decoded packet data, segregating 
the packets from the decoded packet data into 
separate transactions between nodes by ordering 
according to thread and a time interval, 
sequencing the packets corresponding to each 
separate transaction by identifying a packet 
position in a pattern corresponding to each 
separate transaction, and linking together the data 
in each separate transaction when the identified 
positions are determined to produce the 
transaction data, wherein the transaction data is 
derived from a time value and identifies a 
collection of the patterns of packets that is 
substantially optimal for identifying transaction 
instances; and 

a data management module, in 
communication with the packet capturing module 
and the packet analyzing module, for analyzing 
the packet data and the transaction data to 
provide an indication of network usage. 


10-11 

page 6, line 12- page 8, line 5; 
page 19, line 12- page 22, line 18; 
Figures 6C-11 

■ i 1 

page 4, lines 9-25; page 6, line 12- 
page 8, line 12; page 10, lines 5- 
19; page 18, line 21- page 32, line 
26; Figures 1-2 and 6A-12 


34. (New) An apparatus for analyzing 
network activity, the apparatus 
comprising: 

a packet capturing module, for accessing 
packets traversing a network, the packets having 
source and destination addresses of network 
devices exclusive of the apparatus, and for 
filtering the packets to produce packet data; 

a packet analyzing module, in 
communication with the packet capturing module, 
for producing decoded packet data and for 
producing transaction data from the decoded 
packet data, the packet analyzing module 


page 1, lines 5r8; page 4, lines 22- 
25; page 10, lines 5-19; page 32, 
lines 4-17; Figure 12 

page 4, lines 9-12; page 5, lines 
10-18; page 10, line 21 to page 12, 
line 11; page 12, line 19- page 14, 
line 7; pg. 12, lines 5-8; page 15, 
line 15- page 16, line 4; Figures 1- 
6A; Abstract 

page 4, line 9- page 9, line 2; page 
10, line 5- page 1 1, line 16; page 
15, line 15- page 18, line 19; page 
18, line 21- page 32, line 3; 
Figures 1-2 and 6A-1 1 
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comprising: 

a packet decoder, for accessing the packet 
data and producing the decoded packet data; and 

a decoded packet recompiles in 
communication with the packet decoder, for 
accessing the decoded packet data, segregating 
the packets from the decoded packet data into 
separate transactions between nodes, sequencing 
the packets corresponding to each separate 
transaction, and linking together the data in each 
separate transaction to produce the transaction 
data; and 

a data management module, in 
communication with the packet capturing module 
and the packet analyzing module, for analyzing at 
least one of the packet data and the transaction 
data to provide an indication of network usage. 


page 16, line 13- page 18, line 19; 
Figures 1 and 2, 6A-6D, 7-9A, and 
10-11 

page 6, line 12- page 8, line 5; 
page 19, line 12- page 22, line 18; 
Figures 6C-11 

page 4, lines 9-25; page 6, line 12- 
page 8, line 12; page 10, lines 5- 
19; page 18, line 21- page 32, line 
26; Figures 1-2 and 6A-12; 
claims J -2~and-4-*8- 


35. (New) For use with a network activity 
analyzer capable of being coupled to a network 
transmission medium, a method of analyzing 
network activity, the method comprising: 

accessing packets traversing the network, 
the packets having source and destination 
addresses of network devices exclusive of the 
network activity analyzer; 

filtering the packets to produce packet 
data by (a) through (c) following: 

(a) accessing a predetermined address; 

(b) comparing the predetermined 
address to the source and destination addresses 
for a current packet; and 

(c) retaining the current packet when 


page 1, lines 5-8; page 4, lines 22- 
25; page 10, line 5- page 12, line 
2; page 32, lines 4-17; Figures 1-2 
and 12 

page 4, lines 9-12; page 5, lines 
10-18; page 10, line 21 to page 12, 
line 11; page 12, line 19- page 14, 
line 7; pg. 12, lines 5-8; page 15, 
line 15- page 16, line 4; Figures 1- 
6A; Abstract 

page 4, lines 9-12; page 5, lines 
10-18; page 10, line 21 to page 12, 

1* 11 1^1" 1 /~\ 1 A 

line 11; page 12, line 19- page 14, 
line 7; pg. 12, lines 5-8; page 15, 
line 15- page 16, line 4; Figures 1- 
6A; Abstract 



23 



one of the source and destination addresses for 
the current packet matches the predetermined 
address; 

producing decoded packet data, 
wherein the ! decoded packet data includes a 
plurality of patterns of packets; 

producing transaction data from the 
decoded packet data, wherein the transaction data 
is derived from a time value and identifies a 
substantially optimal collection of patterns of 
packets indicative of transaction instances; and 

analyzing the packet data and the 
transaction data to provide an indication of 
network usage. 


page 4, line 9- page 9, line 2; page 
10, line 5- page 1 1, line 16; page 
15, line 15- page 18, line 19; page 
18, line 21- page 32, line 3; 
Figures 1-2 and 6A-1 1 

page 4, line 9- page 9, line 2; page 
10, line 5- page 11, line 16; page 
15; line 15- page 18, line 19; page 
18, line 21- page 32, line 3; 
Figures 1-2 and 6 A- 11 

page 4, lines 9-25; page 6, line 12- 
page 8, line 12; page 10, lines 5- 
19; page 18, line 21- page 32, line 
26; Figures 1-2 and 6A-12 


36. (New) For use with a network 
activity analyzer capable of being coupled to a 
network transmission medium, a method of 
analyzing network activity, the method 
comprising: 

accessing packets traversing the 
network, the packets having source and 
destination addresses of network devices 
exclusive of the network activity analyzer; 

filtering the packets to produce raw 
packet data by (a) through (c) following: 

(a) accessing a predetermined 

address; 

(b) comparing the predetermined 
address to the source and destination addresses 
for a current packet; and 

(c) retaining the current packet 
when one of the source and destination addresses 


page 1, lines 5-8; page 4, lines 22- 
25; page 10, line 5- page 12, line 
2; page 32, lines 4-17; Figures 1-2 
and 12 

page 4, lines 9-12; page 5, lines 
10-18; page 10, line 21 to page 12, 
line 11; page 12, line 19- page 14, 
line 7; pg. 12, lines 5-8; page 15, 
line 15- page 16, line 4; Figures 1- 
6A; Abstract 

page 4, lines 9-12; page 5, lines 
10-18; page 10, line 21 to page 12, 
line 11; page 12, line 19- page 14, 
line 7; pg. 12, lines 5-8; page 15, 
line 15- page 16, line 4; Figures 1- 
6A; Abstract 
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for the current packet matches the predetermined 
address; 

producing decoded packet data; 

producing transaction data from the 
decoded packet data; and 

analyzing the decoded packet data and 
the transaction data to provide an indication of 
network usage. 


page 4, line 9- page 9, line 2; page 
10, line 5- page 1 1, line 16; page 
15, line 15- page 18, line 19; page 
18, line 21- page 32, line 3; 
Figures 1-2 and 6A-1 1 

page 4, line 9- page 9, line 2; page 
10, line 5- page 1 1, line 16; page 
15, line 15- page 18, line 19; page 
18, line 21- page 32, line 3; 
Figures 1-2 and 6 A- 11 

page 4, lines 9-25; page 6, line 12- 
page 8, line 12; page 10, lines 5- 
19; page 18, line 21- page 32, line 
26; Figures 1-2 and 6A-12 


37. (New) For use with a network 
activity analyzer capable of being coupled to a 
network transmission medium, a method of 
analyzing network activity, the method 
comprising: 

accessing packets traversing the 
network, the packets having source and 
destination addresses of network devices 
exclusive of the netw ork activity analyzer; 

filtering the packets to produce packet 
data by; (a) accessing a predetermined port 
address; (b) comparing the predetermined port 
address to source and destination port addresses 
for a current packet; and (c) retaining the current 
packet when one of the source and destination 
port addresses for the current packet matches the 


page 1, lines 5-8; page 4, lines 22- 
25; page 10, line 5- page 12, line 
2; page 32, lines 4-17; Figures 1-2 
and 12 

page 4, lines 9-12; page 5, lines 
10-18; page 10, line 21 to page 12, 
line 11; page 12, line 19- page 14, 
line 7; pg. 12, lines 5-8; page 15, 
line 15- page 16, line 4; Figures 1- 
6A; Abstract 

page 4, lines 9-12; page 5, lines 
10-18; page 10, line 21 to page 12, 
line 11; page 12, line 19- page 14, 
line 7; pg. 12, lines 5-8; page 15, 
line 15- page 16, line 4; Figures 1- 
6A; Abstract 



predetermined port address; 

producing decoded packet data, 
wherein the decoded packet data includes a 
plurality of pattens of packets; 

producing transaction data from the 
decoded packet data, wherein the transaction data 
is derived from a time value for identifying a 
substantially optimal collection of patterns of 
packets indicative of transaction occurrences; and 

analyzing the packet data and the 
transaction data to provide an indication of 
network usage. 


page 4, line 9- page 9, line 2; page 
10, line 5- page 11, line 16; page 
15, line 15- page 18, line 19; page 
18, line 21- page 32, line 3; 
Figures 1-2 and 6A-1 1 

page 4, line 9- page 9, line 2; page 
10, line 5- page 1 1, line 16; page 
15, line 15- page 18, line 19; page 
18, line 21- page 32, line 3; 
Figures 1-2 and 6A-1 1 

page 4, lines 9-25; page 6, line 12- 
page 8, line 12; page 10, lines 5- 
19; page 18, line 21- page 32, line 
26; Figures 1-2 and 6A-12 


3 8 . (New) For use with a network 
activity analyzer capable of being coupled to a 
network transmission medium, a method of 
analyzing network activity, the method 
comprising: 

accessing packets traversing the 
network, the packets having source and 
destination addresses of network devices other 
than an address corresponding to the network 
activity analyzer; 

filtering the packets to produce raw 
packet data by: accessing a predetermined port 
address; comparing the predetermined port 
address to source and destination port addresses 
for a current packet; and retaining the current 
packet when one of the source and destination 
port addresses for the current packet matches the 
predetermined port address; 


page 1, lines 5-8; page 4, lines 22- 
25; page 10, line 5- page 12, line 
2; page 32, lines 4-17; Figures 1-2 
and 12 

page 4, lines 9-12; page 5, lines 
10-18; page 10, line 21 to page 12, 
line 11; page 12, line 19- page 14, 
line 7; pg. 12, lines 5-8; page 15, 
line 15- page 16, line 4; Figures 1- 
6A; Abstract 

page 4, lines 9-12; page 5, lines 
10-18; page 10, line 21 to page 12, 
line 1 1; page 12, line 19- page 14, 
line 7; pg. 12, lines 5-8; page 15, 
line 15- page 16, line 4; Figures 1- 
6A; Abstract 
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producing decoded packet data; 

producing transaction data from the 
decoded packet data; and 

analyzing at least one of the decoded 
packet data and the transaction data to provide an 
indication of network usage. 


page 4, line 9- page 9, line 2; page 
10, line 5- page 1 1, line 16; page 
15, line 15- page 18, line 19; page 
18, line 21- page 32, line 3; 
Figures 1-2 and 6 A- 11 

page 4, line 9- page 9, line 2; page 
10, line 5- page 1 1, line 16; page 
15, line 15- page 18, line 19; page 
18, line 21- page 32, line 3; 
Figures 1-2 and 6A-1 1 

page 4, lines 9-25; page 6, line 12- 
page 8, line 12; page 10, lines 5- 
19; page 18, line 21- page 32, line 
26; Figures 1-2 and 6A-12; 
claims-l-=2-and-4-8 


39. (New) For use with a network 
activity analyzer capable of being coupled to a 
network transmission medium, a method of 
analyzing network activity, the method 
comprising: 

accessing packets traversing the 
network, the packets having source and 
destination addresses of network devices 
exclusive of the network activity analyzer; 

filtering the packets to produce packet 

data; 

producing decoded packet data by 
searching in text of the packet data for one or 
more key words; 


page 1, lines 5-8; page 4, lines 22- 
25; page 10, line 5- page 12, line 
2; page 32, lines 4-17; Figures 1-2 
and 12 

page 4, lines 9-12; page 5, lines 
10-18; page 10, line 21 to page 12, 
line 11; page 12, line 19- page 14, 
line 7; pg. 12, lines 5-8; page 15, 
line 15- page 16, line 4; Figures 1- 
6A; Abstract 

page 4, lines 9-12; page 5, lines 
10-18; page 10, line 21 to page 12, 
line 11; page 12, line 19- page 14, 
line 7; pg. 12, lines 5-8; page 15, 
line 15- page 16, line 4; Figures 1- 
6A; Abstract 

page 16, line 13- page 18, line 19; 
Figures 1 and 2, 6A-6D, 7-9A, and 
10-11 
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producing transaction data from the 
decoded packet data by (a) accessing the decoded 
packet data; (b) segregating the packets from the 
decoded packet data into separate transactions 
between nodes of the network by ordering 
according to thread and a time interval; (c) 
sequencing the packets corresponding to each 
separate transaction by identifying a packet 
position in a pattern corresponding to each 
separate transaction; and (d) linking together the 
data in each separate transaction when the 
identified positions are determined to produce the 
transaction data, wherein the transaction data is 
derived from a time value and identifies a 
collection of the patterns that is substantially 
optimal for identifying transaction instances; and 

analyzing the packet data and the 
transaction data to provide an indication of 
network usage. 


page 6, line 12- page 8, line 5; 
page 19, line 12- page 22, line 18; 
Figures 6C- 11 

page 4, lines 9-25; page 6, line 12- 
page 8, line 12; page 10, lines 5- 
19; page 18, line 21- page 32, line 
26; Figures 1-2 and 6 A- 12 


40. (New) For use with a network 
activity analyzer capable of being coupled to a 
network transmission medium, a method of 
analyzing network activity, the method 
comprising: 

accessing packets traversing the 
network, the packets having source and 
destination addresses other than an address 
corresponding to the network activity analyzer; 

filtering the packets to produce raw 
packet data; 

producing decoded packet data; 


page 1, lines 5-8; page 4, lines 22- 
25; page 10, line 5- page 12, line 
2; page 32, lines 4-17; Figures 1-2 
and 12 

page 4, lines 9-12; page 5, lines 
10-18; page 10, line 21 to page 12, 
line 11; page 12, line 19- page 14, 
line 7; pg. 12, lines 5-8; page 15, 
line 15- page 16, line 4; Figures 1- 
6A; Abstract 

page 4, lines 9-12; page 5, lines 
10-18; page 10, line 21 to page 12, 
line 11; page 12, line 19- page 14, 
line 7; pg. 12, lines 5-8; page 15, 
line 15- page 16, line 4; Figures 1- 
6A; Abstract 

page 16, line 13- page 18, line 19; 
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producing transaction data from the 
decoded packet data by accessing the decoded 
packet data; segregating the packets from the 
decoded packet data into separate transactions 
between nodes of the network; sequencing the 
packets corresponding to each separate 
transaction; and linking together the data in each 
separate transaction to produce the transaction 
data; and 

analyzing at least one of the raw 
packet data, the decoded packet data, and the 
transaction data to provide an indication of 
network usage. 


Figures 1 and 2, 6A-6D, 7-9 A, and 
10-11 

page 6, line 12- page 8, line 5; 
page 19, line 12- page 22, line 18; 
Figures 6C-11 

page 4, lines 9-25; page 6, line 12- 
page 8, line 12; page 10, lines 5- 
19; page 18, line 21- page 32, line 
26; Figures 1-2 and 6A-12; 
-claims-l-^and^-S* 


41. (New) For use with a network activity 
analyzer capable of being coupled to a network 
transmission medium, a method of analyzing 
network activity, the method comprising; 

accessing packets traversing the 
network, the packets having source and 
destination addresses of devices exclusive of the 
activity analyzer; 

filtering the packets to produce packet 

data; 

producing decoded packet data by 
searching in text of the packet data for one or 
more key words; 

producing transaction data from the 


page 1, lines 5-8; page 4, lines 22- 
25; page 10, line 5- page 12, line 
2; /page 32, lines 4-17; Figures 1-2 
ami 12 

page 4, lines 9-12; page 5, lines 
10-18; page 10, line 21 to page 12, 
line 11; page 12, line 19- page 14, 
line 7; pg. 12, lines 5-8; page 15, 
line 15- page 16, line 4; Figures 1- 
6A; Abstract 

page 4, lines 9-12; page 5, lines 
10-18; page 10, line 21 to page 12, 
line 11; page 12, line 19- page 14, 
line 7; pg. 12, lines 5-8; page 15, 
line 15- page 16, line 4; Figures 1- 
6A; Abstract 

page 16, line 13- page 18, line 19; 
Figures 1 and 2, 6A-6D, 7-9 A, and 
10-11 

page 6, line 12- page 8, line 5; 
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decoded packet data by accessing the decoded 
packet data; segregating the packets from the 
decoded packet data into separate transactions 
between nodes by ordering according to thread 
and a time interval; sequencing the packets 
corresponding to each separate transaction by 
identifying a packet position in a pattern 
corresponding to each separate transaction; and 
linking together the data in each separate 
transaction when the identified positions are 
determined to produce the transaction data, 
wherein the transaction data is derived from a 
time value and identifies a collection of the 
patterns that is substantially optimal for 
identifying transaction instances; and 

producing translated transaction data 
from the transaction data wherein the translated 
transaction data includes response data 
aggregated according to a fixed time interval; and 

analyzing the packet data and the 
transaction data to provide an indication of 
network usage. 


page 19, line 12- page 22, line 18; 
Figures 6C-1 1 

page 6, line 12- page 8, line 5; 
page 19, line 12- page 22, line 18; 
Figures 6C-11 

page 32, lines 4-17 

page 4, line 9- page 9, line 2; page 
10, line 5- page 1 1, line 16; page 
15, line 15- page 18, line 19; page 
18, line 21- page 32, line 3; 
Figures 1-2 and 6A-1 1 


42. (New) For use with a network 
activity analyzer capable of being coupled to a 
network transmission medium, a method of 
analyzing network activity, the method 
comprising; 

accessing packets traversing the 
network, the packets having source and 
destination addresses of devices exclusive of the 
activity analyzer; 
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filtering the packets to produce packet 

data; 

producing decoded packet data; 

producing transaction data from the 
decoded packet data by accessing the decoded 
packet data; segregating the packets from the 
decoded packet data into separate transactions 
between nodes; sequencing the packets 
corresponding to each separate transaction; and 
linking together the data in each separate 
transaction; 

producing translated transaction data 
from the transaction data; and 

analyzing the packet data and the 
transaction data to provide an indication of 
network usage. 
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43 . (New) An apparatus for analyzing 
network activity, the apparatus comprising: 

means for accessing packets traversing 
the network, the packets having source and 
destination addresses of devices exclusive of the 
network activity analyzer; 
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means for filtering the packets to 
produce packet data, wherein the means for 
filtering the packets to produce packet data 
includes routines for retrieving a predetermined 
address; comparing the predetermined address to 
the source and destination addresses for a current 
packet; and retaining the current packet when one 
of the source and destination addresses for the 
current packet matches the predetermined 
address; 

means for producing decoded packet 
data, wherein the decoded packet data includes a 
plurality of patterns of packets; 

means for producing transaction data 
from the decoded packet data, wherein the 
transaction data is derived from a time value for 
identifying a substantially optimal collection of 
patterns of packets indicative of transaction 
instances; and 

means for analyzing the packet data 
and the transaction data to provide an indication 
of network usage. 
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44. (New) An apparatus for analyzing 
network activity, the apparatus comprising: 

means for accessing packets traversing 

a1 A 1 A 1 1.1* 1 

the network, the packets having source and 
destination addresses of devices exclusive of the 
network activity analyzer; 
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means for filtering the packets to 
produce packet data, wherein the means for 
filtering the packets to produce packet data 
includes routines for retrieving a predetermined 
address; comparing the predetermined address to 
the source and destination addresses for a current 
packet; and retaining the current packet when one 
of the source and destination addresses for the 
current packet matches the predetermined 
address; 

means for producing decoded packet 

data; 

means for producing transaction data 
from the decoded packet data; and 

means for analyzing the packet data 
and the transaction data to provide an indication 
of network usage. 
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45. (New) An apparatus for analyzing 
network activity, the apparatus comprising: 

means for accessing packets traversing 
the network, the packets having source and 
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destination addresses for network devices 
exclusive of the network activity analyzer; 


page 1, lines 5-8; page 4, lines 22- 
25; page 10, line 5- page 12, line 
2; page 32, lines 4-17; Figures 1-2 
and 12 

page 4, lines 9-12; page 5, lines 
10-18; page 10, line 21 to page 12, 
line 11; page 12, line 19- page 14, 
line 7; pg. 12, lines 5-8; page 15, 
line 15- page 16, line 4; Figures 1- 
6A; Abstract 



33 



means for filtering the packets to 
produce packet data, wherein the means for 
filtering the packets to produce packet data 
includes routines for accessing a predetermined 
port address; comparing the predetermined port 
address to a source port address for a current 
packet; comparing the predetermined port address 
to a destination port address for the current 
packet; and retaining the current packet when one 
of the source and destination port addresses for 
the current packet matches the predetermined 
port address; 

means for producing decoded packet 
data, wherein the decoded packet data includes a 
plurality of patterns of packets; 

means for producing transaction data 
from the decoded packet data, wherein the 
transaction data is derived from a time value for 
identifying a substantially optimal collection of 
packets indicative of transaction occurrences; and 

means for analyzing the packet data 
and the transaction data to provide an indication 
of network usage. 
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46. (New) An apparatus for analyzing 
network activity, the apparatus comprising: 

means for accessing packets traversing 
,i . i^i lit* j 
the network, the packets having source and 

destination addresses for network devices other 

than an address corresponding to the network 

activity analyzer; 
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means for filtering the packets to 
produce raw packet data, wherein the means for 
filtering the packets to produce raw packet data 
includes routines for retrieving a predetermined 
port address; comparing the predetermined port 
address to a source port address for a current 
packet; comparing the predetermined port address 
to a destination port address for the current 
packet; and retaining the current packet when one 
of the source and destination port addresses for 
the current packet matches the predetermined 
port address; 

means for producing decoded packet 

data; 

means for producing transaction data 
from the decoded packet data; and 

means for analyzing at least one of the 
decoded packet data and the transaction data to 
provide an indication of network usage. 
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47. (New) An apparatus for analyzing 
network activity, the apparatus comprising; 

means for accessing packets traversing 
the network, the packets having source and 
destination addresses other than an address 
corresponding to the network activity analyzer; 
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means for filtering the packets to 
produce packet data; 



means for producing decoded packet 
data by searching in text of the packet data for 
one or more key words; 

means for producing transaction data 
from the decoded packet data, wherein the means 
for producing transaction data includes routines 
for accessing the decoded packet data; 
segregating the packets from the decoded packet 
data into separate transactions between nodes by 
ordering according to thread and a time interval; 
sequencing the packets corresponding to each 
separate transaction by identifying a position in a 
pattern corresponding to each separate 
transaction; and linking together the data in each 
separate transaction when the identified positions 
are determined to produce the transaction, 
wherein the transaction data is derived from a 
time value and identifies a collection of the 
patterns that is substantially optimal for 
identifying transaction instances; and 

means for analyzing the packet data, 
and the transaction data to provide an indication 
of network usage. 
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48. (New) An apparatus for analyzing 
network activity, the apparatus comprising; 



. means for accessing packets traversing 
the network, the packets having source and 
destination addresses other than an address 
corresponding to the network activity analyzer; 
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means for filtering the packets to 
produce raw packet data; 



data; 



means for producing decoded packet 



means for producing transaction data 
from the decoded packet data, wherein the means 
for producing transaction data includes routines 
for accessing the decoded packet data; 
segregating the packets from the decoded packet 
data into separate transactions between nodes; 
sequencing the packets corresponding to each 
separate transaction; and linking together the data 
in each separate transaction to produce the 
transaction data; and 

means for analyzing the decoded 
packet data and the transaction data to provide an 
indication of network usage. 
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Pursuant to 37 C.F.R. §1. 607(a) 1, Applicant presents the following proposed 



count 1: 



1 . An apparatus for analyzing network activity, the apparatus comprising: 
a packet capturing module, for accessing packets traversing a network, the packets 
having source and destination addresses other than an address corresponding to the apparatus, 
and for filtering the packets to produce raw packet data, wherein the packet capturing module 
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produces the raw packet data by accessing a predetermined address, comparing the 
predetermined address to the network source address for a current packet, comparing the 
predetermined address to a network destination address for the current packet, and retaining 
the current packet where one of the network source and destination addresses for the current 
packet matches the predetermined address; 

a packet analyzing module, in communication with the packet capturing module, 
for producing decoded packet data and for producing transaction data from the decoded 
packet data; and 

a data management module, in communication with the packet capturing module 
and the packet analyzing module, for analyzing at least one of the raw packet data, the 
decoded packet data and the transaction data to provide an indication of network usage. 

Applicants submit that patent claim 1 ofU.S. Patent No. 5,787,253 and Applicants 
Claims 29 and 30 substantially correspond to proposed Count 1. 

Pursuant to 37 C.F.R. §1. 607(a) 1, Applicant presents the following proposed 

count 2: 

2. An apparatus for analyzing network activity, the apparatus comprising: 
a packet capturing module, for accessing packets traversing a network, the packets 
having source and destination addresses other than an address corresponding to the apparatus, 
and for filtering the packets to produce raw packet data, wherein the packet capturing module 
produces the raw packet data by accessing a predetermined port address, comparing the 
predetermined port address to a source port address for a current packet, comparing the 
predetermined port address to a destination port address for the current packet, and retaining 
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the current packet where one of the source and destination port addresses for the current 
packet matches the predetermined port address; 

a packet analyzing module, in communication ;with the packet capturing module, 
for producing decoded packet data and for producing transaction data from the decoded 
packet data; and 

a data management module, in communication with the packet capturing module 
and the packet analyzing module, for analyzing at least one of the raw packet data, the 
decoded packet data and the transaction data to provide an indication of network usage. 

Applicants submit that patent claim 2 ofU. S. Patent No. 5,787,253 and Applicants 
Claims 31 and 32 substantially correspond to proposed Count 2. 

Pursuant to 37 C.F.R. §1.607(a) 1, Applicant presents the following proposed 

count 3: 

3. An apparatus for analyzing network activity, the apparatus comprising: 
a packet capturing module, for accessing packets traversing a network, the 
packets having source and destination addresses other than an address corresponding to the 
apparatus, and for filtering the packets to produce raw packet data; 

a packet analyzing module, in communication with the packet capturing module, 
for producing decoded packet data; and for producing transaction data from the decoded 
packet data, the packet analyzing module comprising: a packet decoder, for accessing the 
raw packet data and producing the decoded packet data; and a decoded packet recompiles 
in communication with the packet decoder, for accessing the decoded packet data, 
segregating the packets from the decoded packet data into separate transactions between 
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nodes, sequencing the packets corresponding to each separate transaction, and linking 
together the data in each separate transaction to produce the transaction data; and 

a data management module, in communication with the packet capturing module 
and the packet analyzing module, for analyzing at least one of the raw packet data, the 
decoded packet data and the transaction data to provide an indication of network usage. 

Applicants submit that patent chum 3 ofU. S. Patent No. 5,787,253 and Applicants 
Claims 33 and 34 substantially correspond to proposed Count 3. 

Pursuant to 37 C.F.R. § 1.607(a) 1, Applicant presents the following proposed 

count 4: 

4. For use with a network activity analyzer capable of being coupled to a 
network transmission medium, a method of analyzing network activity, the method 
comprising: 

accessing packets traversing the network, the packets having source and 
destination addresses other than an address corresponding to the network activity analyzer; 

filtering the packets to produce raw packet data by: accessing a predetermined 
address; comparing the predetermined address to a source address for a current packet; 
comparing the predetermined address to a destination address for the current packet; and 
retaining the current packet where one of the source and destination addresses for the current 
packet matches the predetermined address; 

producing decoded packet data; 

producing transaction data from the decoded packet data ; and 



analyzing at l east one of the raw packet data, the decoded packet data and the 
transaction data to provide an indication of network usage. 

Applicants submit that patent claim 10 of U.S. Patent No. 5,787,253 and 
Applicants Claims 35 and 36 substantially correspond to proposed Count 4. 

Pursuant to 37 C.RR. § 1.607(a) 1, Applicant presents the following proposed 

count 5: 

5 . For use with a network activity analyzer capable ofbeing coupled to a network 
transmission medium, a method of analyzing network activity, the method comprising; 

accessing packets traversing the network, the packets having source and 
destination addresses of network devices other than an address corresponding to the network 
activity analyzer; 

filtering the packets to produce raw packet data by: accessing a predetermined 
port address; comparing the predetermined port address to a source port address for a current 
packet; comparing the predetermined port address to a destination port address for the 
current packet; and retaining the current packet where one of the source and destination port 
addresses for the current packet matches the predetermined port address; 

producing decoded packet data; 

producing transaction data from the decoded packet data; and 

analyzing at least one of the raw packet data, the decoded packet data and the 

transaction data to provide an indication of network usage. 

Applicants submit that patent claim 11 of U.S. Patent No. 5,787,253 and 

Applicants Claims 37 and 38 substantially correspond to proposed Count 5. 



Pursuant to 37 C.F.R. §1. 607(a) 1, Applicant presents the following proposed 

count 6: 

6. For use with a network activity analyzer capable ofbeing coupled to a network 
transmission medium, a method of analyzing network activity, the method comprising: 

accessing the packets traversing the network, the packets having source and 
destination addresses other than an address corresponding to the network activity analyzer; 
filtering the packets to produce raw packet data; 
producing decoded packet data; 

producing transaction data from the decoded packet data by: accessing the 
decoded packet data; segregating the packets from the decoded packet data into separate 
transactions between nodes of the network; sequencing the packets corresponding to each 
separate transaction, and linking together the data in each separate transaction to produce the 
transaction data; and 

analyzing at least one of the raw packet data, the decoded packet data and the 
transaction data to provide an indication of network usage. 

Applicants submit that patent claim 12 of U.S. Patent No. 5,787,253 and 
Applicants Claims 39 and 40 substantially correspond to proposed Count 6. 

Pursuant to 37 C.F.R. § 1.607(a) 1, Applicant presents the following proposed 

count 7: 

7 . For use with a network activity analyzer capable ofbeing coupled to a network 
transmission medium, a method of analyzing network activity, the method comprising: 
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accessing packets traversing the network, the packets having source and 
destination addresses other than an address corresponding to the activity analyzer; 
filtering the packets to produce packet data; 
producing decoded packet data; 

producing transaction data from the decoded packet data by accessing the decoded 
packet data; segregating the packets from the decoded packet data into separate transactions 
between nodes; sequencing the packets corresponding to each separate transaction; and 
linking together the data in each separate transaction to produce the transaction data; and 
producing translated transaction data from the transaction data; and 
analyzing at least one of the raw packet data, the decoded packet data, the 
transaction data, and the translated transaction data to provide an indication of network 
usage. 

Applicants submit that patent claim 14 of U.S. Patent No. 5,787,253 and 
Applicants Claims 41 and 42 substantially correspond to proposed Count 7. 

Pursuant to 37 C.F.R. §1. 607(a) 1, Applicant presents the following proposed 

count 8: 

8. An apparatus for analyzing network activity, the apparatus comprising: 
means for accessing the packets traversing the network, the packets having source 

and destination addresses other than an address corresponding to the network activity 

analyzer; 

means for filtering the packets to produce packet data, wherein the means for 
filtering the packets to produce raw packet data includes routines for accessing a 



predetermined address; comparing the predetermined address to a source address for a 
current packet; comparing the predetermined address to a destination address for the current 
packet; and retaining the current packet where one of the source and destination addresses 
for the current packet matches the predetermined address; 
means for producing decoded packet data; 

means for producing transaction data from the decoded packet data; and 

means for analyzing at least one of the raw packet data, the decoded packet data 
and the transaction data to provide an indication of network usage. 

Applicants submit that patent claim 20 of U.S. Patent No. 5,787,253 and 
Applicants Claims 43 and 44 substantially correspond to proposed Count 8. 

Pursuant to 37 C.F.R. § 1.607(a) 1, Applicant presents the following proposed 

count 9: 

9. An apparatus for analyzing network activity, the apparatus comprising: 

means for accessing packets traversing the network, the packets having source and 
destination addresses other than an address corresponding to the network activity analyzer; 

means for filtering the packets to produce raw packet data, wherein the means for 
filtering the packets to produce raw packet data includes routines for accessing a 
predetermined port address; comparing the predetermined port address to a source port 
address for a current packet; comparing the predetermined port address to a destination port 
address for the current packet; and retaining the current packet where one of the source and 
destination port addresses for the current packet matches the predetermined port address; 

means for producing decoded packet data; 
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means for producing transaction data from the decoded packet data; and 

means for analyzing at least one of the raw packet data, the decoded packet data 
and the transaction data to provide an indication of network usage. 

Applicants submit that patent claim 21 of U.S. Patent No. 5,787,253 and 
Applicants Claims 45 and 46 substantially correspond to proposed Count 9. 

Pursuant to 37 C.F.R. § 1.607(a) 1, Applicant presents the following proposed 

count 10: 

10. An apparatus for analyzing network activity, the apparatus comprising: 
means for accessing packets traversing the network, the packets having source and 
destination addresses other than an address corresponding to the network activity analyzer; 
means for filtering the packets to produce raw packet data; 
means for producing decoded packet data; 

means for producing transaction data from the decoded packet data, wherein the 
means for producing transaction data includes routines for accessing the decoded packet data; 
segregating the packets from the decoded packet data into separate transactions between 
nodes; sequencing the packets corresponding to each separate transaction; and linking 
together the data in each separate transaction to produce the transaction data; and 

means for analyzing at least one of the raw packet data, the decoded packet data 
and the transaction data to provide an indication of network usage. 

Applicants submit that patent claim 22 of U.S. Patent No. 5,787,253 and 
Applicants Claims 47 and 48 substantially correspond to proposed Count 10. 
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As disclosed in the present application, newly presented Claims 29-48 are 



patentable over U.S. Patent No. 5,787,253 because the subject matter is entitled to a priority 
date of at least August 10, 1995, which is prior to May 28, 1996, the filing date for U.S. 
Patent No. 5,787,253. 

Applicant respectfully directs the Examiner to consider related, pending 
applications to U.S. Patent No. 5,787,253, to McCreery et al. In an Amendment mailed on 
November 18, 1997, McCreery et al. canceled independent claims 3, 14 and 26 to pursue 
their subject matter in a continuation application. Applicant has reviewed these claims and 
believes that the claims are directed to the same patentable invention as the present invention. 



Respectfully submitted, 



SHERIDAN ROSS P C. 



By: 
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Registration No. 37,739 
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